Loading npm security reports…
Lightweight, flexible Git automation tool. Works as a desktop app and npm CLI tool.
A failed explicit CLI push invokes a remote AI fixer and executes its returned command list without validation. This is an arbitrary-command-execution vulnerability, not evidence of a covert payload.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgPackage source invokes a package manager install command at runtime.
bin/postinstall.jsView on unpkg · L13Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
src/main/index.tsView on unpkg · L16Package ships non-JavaScript build or shell helper files.
build-linux.shView on unpkgPackage defines install-time lifecycle scripts.
package.jsonView on unpkg · L23Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L23Package source references child process execution.
bin/postinstall.jsPackage ships non-JavaScript build or shell helper files.
build-linux.shView on unpkgPackage source invokes a package manager install command at runtime.
bin/postinstall.jsView on unpkg · L13Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
src/main/index.tsView on unpkg · L16